Loading the runbook…
Recovery standby
Every backup, and how fresh it is.
Read-only from R2 with this server's own credentials. It stays up when the M6 is down.
Connecting…
Needs attention
Stale or unreadable backups and missing credentials.
Restore a lineage
A proof restores the newest backup into an isolated container with no network, checks it, and removes it. Serving keeps it running on this server's Tailscale address for the apps, only when the M6 is down.
Serving now
Restored copies reachable by Tailscale peers. Tear them down once the M6 is back.
Restore jobs
Every action is journaled step by step on this server.
This server
The standby's own health.
Keys and credentials
Names only. Values never leave this server.
Last drill
A real restore from R2 on this server, compared against the live database.